CVE-2026-23866 | Medium | 4.3 | 2026-05-01 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26… |
CVE-2026-23863 | Medium | 6.5 | 2026-05-01 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL by… |
CVE-2025-55179 | Medium | 5.4 | 2025-11-18 | Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23… |
CVE-2025-55177 | Medium | 5.4 | 2025-08-29 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp… |
CVE-2025-30401 | Medium | 6.7 | 2025-04-05 | A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler bas… |
CVE-2023-38538 | Medium | 5.0 | 2023-10-04 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexp… |
CVE-2023-38537 | Medium | 5.6 | 2023-10-04 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have re… |
CVE-2022-27492 | High | 7.8 | 2022-09-23 | An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file. |
CVE-2022-36934 | Critical | 9.8 | 2022-09-22 | An integer overflow in WhatsApp could result in remote code execution in an established video call. |
CVE-2020-20096 | Medium | 6.5 | 2022-03-23 | Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofin… |
CVE-2021-24043 | Critical | 9.1 | 2022-02-02 | A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230… |
CVE-2021-24042 | Critical | 9.8 | 2022-01-04 | The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Bu… |
CVE-2021-24041 | Critical | 9.8 | 2021-12-07 | A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-o… |
CVE-2021-24035 | Critical | 9.1 | 2021-06-11 | A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed… |
CVE-2021-24027 | High | 7.5 | 2021-04-06 | A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to… |
CVE-2021-24026 | Critical | 9.8 | 2021-04-06 | A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v… |
CVE-2020-1910 | High | 7.8 | 2021-02-02 | A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read… |
CVE-2020-1909 | Critical | 9.8 | 2020-11-03 | A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory cor… |
CVE-2020-1908 | Medium | 4.6 | 2020-11-03 | Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact wit… |
CVE-2020-1907 | Critical | 9.8 | 2020-10-06 | A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsA… |
CVE-2020-1906 | High | 7.8 | 2020-10-06 | A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when… |
CVE-2020-1905 | Low | 3.3 | 2020-10-06 | Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have all… |
CVE-2020-1904 | Medium | 5.5 | 2020-10-06 | A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwr… |
CVE-2020-1903 | Medium | 5.5 | 2020-10-06 | An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulte… |
CVE-2020-1902 | High | 7.5 | 2020-10-06 | A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35… |
CVE-2020-1901 | Medium | 5.3 | 2020-10-06 | Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message. |
CVE-2020-1894 | High | 8.8 | 2020-09-03 | A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and W… |
CVE-2020-1891 | Critical | 9.8 | 2020-09-03 | A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone p… |
CVE-2020-1890 | High | 7.5 | 2020-09-03 | A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticke… |
CVE-2020-1889 | Critical | 10.0 | 2020-09-03 | A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege i… |
CVE-2020-1886 | High | 8.8 | 2020-09-03 | A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a… |
CVE-2019-11928 | Medium | 6.1 | 2020-09-03 | An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially craf… |
CVE-2019-18426 | High | 8.2 | 2020-01-21 | A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and l… |
CVE-2019-11931 | High | 7.8 | 2019-11-14 | A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the e… |
CVE-2019-11933 | Critical | 9.8 | 2019-10-23 | A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remote attackers to ex… |
CVE-2019-11932 | High | 8.8 | 2019-10-03 | A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android… |
CVE-2019-11927 | High | 7.8 | 2019-09-27 | An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags… |
CVE-2019-3571 | Medium | 5.3 | 2019-07-16 | An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed wi… |
CVE-2018-6350 | Critical | 9.8 | 2019-06-14 | An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, Wh… |
CVE-2018-6349 | Critical | 9.8 | 2019-06-14 | When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affe… |
CVE-2018-6339 | Critical | 9.8 | 2019-06-14 | When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant… |
CVE-2018-20655 | Critical | 9.8 | 2019-06-14 | When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects… |
CVE-2019-3568 | Critical | 9.8 | 2019-05-14 | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number… |
CVE-2019-3566 | Medium | 5.9 | 2019-05-10 | A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover pre… |
CVE-2018-6344 | High | 7.5 | 2018-12-31 | A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used to cause denial of… |
CVE-2017-8769 | Medium | 4.6 | 2017-05-18 | Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) asso… |